Breach at ID verification firm IDScan.net exposes 153 million+ driver's license scans; FBI investigating, at least four class actions filed

Scans of more than 153 million US and Canadian driver's licenses, traced to identity verification provider IDScan.net, were offered for sale on the Nexus dark web marketplace; IDScan.net disclosed a possible cloud-platform breach on September 4, 2026, the FBI…

Digital scans of more than 153 million US and Canadian driver's licenses were offered for sale on the Russian cybercrime forum Exploit via Nexus, a dark web marketplace, alongside more than 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards. KrebsOnSecurity traced the leak to IDScan.net, a B2B identity verification provider whose clients include Hertz, FedEx, hundreds of US cannabis dispensaries, banks, and gun stores; Nexus was taken down shortly after the findings were published. IDScan.net learned around September 1, 2026 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers, and posted a breach notice on September 4, 2026 that was hidden from search-engine indexing; as of the earliest report that day the company had not yet issued an official statement. The company is offering free credit monitoring and has not disclosed how many customers were affected. At least four class-action lawsuits have been filed in the US District Court for the Eastern District of Louisiana, and the FBI has opened an inquiry into the breach. Reportedly affected individuals include US Defense Secretary Pete Hegseth and journalist Brian Krebs, who first reported the story.

• More than 153 million US and Canadian driver's license scans were offered for sale on Nexus, a dark web marketplace tied to the Russian cybercrime forum Exploit
• The offered data also included over 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards
• KrebsOnSecurity traced the leak to IDScan.net, a B2B identity verification provider serving Hertz, FedEx, hundreds of US cannabis dispensaries, banks, and gun stores
• IDScan.net learned around September 1, 2026 of possible unauthorized access; its September 4, 2026 breach notice said an unauthorized third party may have accessed or copied customer data in its cloud platform, potentially including full…
• The breach notice was hidden from search-engine indexing; as of the September 4 report, IDScan.net had not issued an official statement
• IDScan.net is offering free credit monitoring and has not disclosed how many customers were affected
• At least four class-action lawsuits have been filed in the US District Court for the Eastern District of Louisiana
• The FBI has opened an inquiry into the breach